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Abstract 


Boeing-Canoga Park (BCP) and NASA-Marshall Space Flight Center (NASA-MSFC) are 
developing an Advanced Health Management System (AHMS) for use on the Space Shuttle 
Main Engine (SSME) that will improve Shuttle safety by reducing the probability of 
catastrophic engine failures during the powered ascent phase of a Shuttle mission. This is a 
phased approach that consists of an upgrade to the current Space Shuttle Main Engine 
Controller (SSMEC) to add turbomachinery synchronous vibration protection and addition 
of a separate Health Management Computer (HMC) that will utilize advanced algorithms to 
detect and mitigate predefined engine anomalies. The purpose of the Shuttle AHMS is 
twofold; one is to increase the probability of successfully placing the Orbiter into the 
intended orbit, and the other is to increase the probability of being able to safely execute an 
abort of a Space Transportation System (STS) launch. Both objectives are achieved by 
increasing the useful work envelope of a Space Shuttle Main Engine after it has developed 
anomalous performance during launch and the ascent phase of the mission. This increase in 
work envelope will be the result of two new anomaly mitigation options, in addition to 
existing engine shutdown, that were previously unavailable. The added anomaly mitigation 
options include engine throttle-down and performance correction (adjustment of engine 
oxidizer to fuel ratio), as well as enhanced sensor disqualification capability. The HMC is 
intended to provide the computing power necessary to diagnose selected anomalous engine 
behaviors and for making recommendations to the engine controller for anomaly mitigation. 
Independent auditors have assessed the reduction in Shuttle ascent risk to be on the order of 
40% with the combined system and a three times improvement.in mission success. 


Nomenclature 


AHMS 

= 

Advanced Health Management System 

ARTVMS 

= 

Advanced Real-Time Vibration Monitoring System 

ATO 

= 

Abort to Orbit 

BCP 

= 

Boeing-Canoga Park (Rocketdyne) 

BIST 

= 

Built-In Self Test 

CCA 

= 

Circuit Card Assembly 

COP 

= 

Common On-board Processor 

DARE 

= 

Dynamic Ascent Risk Evaluation 

DCU 

= 

Digital Computer Unit 

DSC 

= 

Dedicated Signal Conditioner 

DSP 

= 

Digital Signal Processor 
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EEPROM 

= 

Electrically Erasable Programmable Read Only Memory 

EHAF 

= 

Engine Health Assessment Function 

FASCOS 

— 

Flight Accelerometer Safety Cutoff System 

GSE 

= 

Ground Support Equipment 

HISM 

= 

HMC Inter-System Monitor 

HMC 

= 

Health Management Computer 

HPFTP 

= 

High Pressure Fuel Turbopump 

HPOTP 

= 

High Pressure Oxidizer Turbopump 

HSSI 

= 

High Speed Serial Interface 

I/O 

= 

Input/Output 

ISS 

= 

International Space Station 

LCC 

= 

Launch Commit Criteria 

LEM 

= 

Linear Engine Model 

MDNVM 

= 

Mission Data Non-Volatile Memory 

MECO 

= 

Main Engine Cut-Off 

MPS 

= 

Main Propulsion System 

MR 

= 

Mixture (oxidizer-to-fuel) Ratio 

MSFC 

= 

Marshall Space Flight Center 

NASA 


National Aeronautics and Space Administration 

OPB 

- 

Oxidizer Prebumer 

QRAS 

= 

Quantitative Risk Assessment System 

RTLS 

= 

Return to Launch Site 

SNR 

= 

Signal to Noise Ratio 

SSC 

= 

Stennis Space Center 

SSME 

= 

Space Shuttle Main Engine 

SSMEC 

= 

Space Shuttle Main Engine Controller 

STS 

= 

Space Transportation System 

TAL 

= 

Transoceanic Abort Landing 


I. Introduction 

T he Space Shuttle Main Engine (SSME) is the world’s first reusable rocket engine and serves as the backbone of 
NASA’s current plans for manned space flight. The SSME has performed reliably and safely for 113 Space 
Transportation System (STS) missions and has accumulated over one million seconds of hot-fire operation 
during in-flight and ground test operation. The purpose of the SSME is to provide thrust for a mission duration and 
to run without catastrophic, uncontained failure. The SSME has not experienced any uncontained failures inflight 
and has only experienced one in-flight shutdown, which was an erroneous shutdown caused by faulty sensors. 
Since the health of both crew and Shuttle Orbiter are heavily dependent on the reliable and safe operation of the 
SSME, Boeing-Canoga Park (BCP) (also known as Rocketdyne) and NASA-Marshall Space Flight Center (NASA- 
MSFC) are developing an Advanced Health Management System (AHMS) that is being designed to enhance the 
reliability and safety of the engine by improving the ability to detect and mitigate anomalous conditions. The 
purpose of the AHMS is twofold; one is to increase the probability of successfully placing the Orbiter into the 
intended orbit, and the other is to increase the probability of being able to safely execute an abort of a STS launch. 
Both objectives are achieved by increasing the useful work envelope of a Space Shuttle Main Engine after it has 
developed anomalous performance during launch and the ascent phase of the mission. This increase in work 
envelope will be the result of two anomaly mitigation options, in addition to existing engine shutdown, that were 
previously unavailable. The added anomaly mitigation options include engine throttle-down and performance 
correction (adjustment of oxidizer to fuel ratio), in addition to enhanced sensor disqualification capability. The 
HMC is intended to provide the computing power necessary to diagnose selected anomalous engine behaviors and to 
make recommendations to the engine controller for anomaly mitigation. 

II. Discussion of AHMS Phase 1 

The SSMEC is a pressurized, thermally conditioned electronics package, when installed on the main engine, 
operates in conjunction with vehicle command and recorder channels, engine sensors, pneumatic valves, hydraulic 
actuators, spark igniters, and electrical harnesses to provide a self-contained system for engine control, checkout and 
monitoring. Each controller contains two redundant digital computer units to enhance reliability by allowing 
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continued operation after the first failure and a fail-safe shutdown after a second failure. The SSMEC utilizes open 
loop sequencing during the start and shutdown phases and actively controls engine chamber pressure and mixture 
ratio in a closed loop fashion during Mainstage operation, issuing instructions to the engine control elements 50 
times per second (every 20 milliseconds). High-reliability electronic parts are used throughout the controller. The 
digital computer is programmable, allowing engine control equations and constants to be modified by changing the 
software. The controller is packaged in a sealed, pressurized chassis and is cooled by convection heat transfer 
through pin fins as part of the main chassis. The electronics are distributed on functional modules with special 
thermal and vibration protection. The controller provides engine flight readiness verification, engine start and 
shutdown sequencing, closed-loop thrust and propellant mixture ratio control, sensor excitation, valve actuator and 
spark igniter control signals, engine performance limit monitoring, and performance and maintenance data. The 
controller also provides onboard engine checkout, response to vehicle commands, and transmission of engine status. 

The Phase 1 upgrade to the SSMEC consists of addition of new Digital Signal Processor (DSP)/high speed serial 
interface (HSSI) cards and accompanying outside world connectors, redesign of the existing Digital Computer Unit 
(DCU) memory, and elimination of the controller batteries and replacement with non-volatile Electrically Erasable 
Programmable Read Only Memory (EEPROM). The addition of the HSSI will allow SSMEC communication with 
Phase 2 of the AHMS project. See Figure 1 for a schematic showing details of the Phase 1 SSMEC upgrade. 





9 new cards 

4 DSP Cards (Vib monitor) 
4 Memory Cards 
1 1nput Electronics Card 


2 new connector ports 
for communication with HMC 


Figure 1: Cutaway of SSMEC with Details of Phase 1 Upgrade 

The current SSMEC incorporates numerous health monitoring techniques during the various operating phases 
based on engine pressure and temperature measurements. These take the form of single parameter “redimes” or 
limits, when exceeded, lead to an autonomous shutdown of the engine. Numerous failure modes of the engine are 
covered by these redlines with the notable exception being high pressure turbopump vibration. The turbopumps 
are the key elements in the engine’s ability to provide thrust by providing the main chamber with the pressure 
needed to generate the thrust required by the vehicle during the ascent phase. However, this capability has not 
existed in flight due to the inability to distinguish a failed sensor from a failed turbopump. The SSME Project has 
long attempted to develop a reliable means to measure turbopump vibration and take action when such 
measurements indicate pending hardware failure. The Flight Accelerometer Safety Cutoff System (FASCOS) was 
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developed to perform this function and has been used successfully in ground testing to mitigate failures. However, 
planned use of FASCOS in the flight program was put on hold indefinitely after flight STS-32R data showed that 
noise on multiple accelerometer channels would have been erroneously interpreted by FASCOS as a hardware 
failure. Had FASCOS been active on that flight, a nominal SSME would have been erroneously shut down. The 
shortcoming with FASCOS and previous vibration monitoring systems, as indicated above, is that all analysis had to 
be conducted in the time domain utilizing a composite signal to assess turbopump health. While this approach is 
reliable when the instrumentation is functioning properly, it may lead to erroneous conclusions if instrumentation is 
faulty. 

BCP and NASA-MSFC engineering personnel, using advanced DSP technology, have developed a system with 
the capability to extract and monitor discrete turbopump vibration frequency components in real time 1 . This system 
has been used successfully at the NASA-Stennis Space Center (SSC) during SSME hot-fire testing as an active 
vibration redline cutoff system since October 1996. The system has monitored more than 400 tests, generated no 
erroneous shutdowns and suffered no system failures. Additionally, a prototype system was demonstrated on STS- 
96 as a component of the Integrated Vehicle Health Management Technology Demonstration. This algorithm, 
coupled with newly developed sensor qualification logic, provides a reliable means by which anomalous 
turbomachinery vibration can be distinguished from accelerometer signal noise. 

Phase 1 synchronous vibration data monitoring will begin at engine start with vibration data from three High 
Pressure Fuel Turobpump (HPFTP) and three High Pressure Oxidizer Turbopump (HPOTP) accelerometers being 
continuously collected and examined through main engine cut-off (MECO) in order to assess turbopump health. 2 
The synchronous vibration redline shutdown capability will not be enabled until approximately engine start +5.0 
seconds to ensure a stable, post start transient synchronous vibration signal is present. Since the Phase 1 system will 
have the capability to examine engine health prior to vehicle lift-off, it may be able to improve the current level of 
“hold-down” health monitoring (i.e. new and/or improved launch commit criteria (LCC)). 

The six high-pressure turbopump accelerometer signals, from the pump end of the turbomachine, are sent to the 
Phase 1 controller and routed internally to the new DSP/HSSI cards where they are examined and qualified using the 
newly developed sensor qualification algorithm. Key parameters for determining the validity of the accelerometer 
signals are 1) synchronous (sync) amplitude, 2) sync noise floor, 3) background noise band amplitude, 4) 50 - 800 
Hz composite amplitude, 5) cross accelerometer composite amplitude comparison, and 5) synchronous signal to 
noise ratio (SNR). 

In all cases, only qualified sensors will be used to determine the health of the turbomachinery. Disqualified 
sensors will be removed from the synchronous redline logic. Two of the three turbopump accelerometers must be 
qualified or the redline will be deactivated (i.e., redline shutdown can be made on a 3 of 3 or a 2 of 2 vote). 

Implementation of AHMS Phase 1 is calculated to result in an approximate 23% reduction in SSME ascent risk 
(three engine cluster) as compared to SSME ascent risk with the Block II engine configuration. Note that this risk 
reduction value was derived from October 1998 Quantitative Risk Assessment System (QRAS) data. 

m. Discussion of AHMS Phase 2 

As capable as the SSMEC is at controlling the SSME, it is incapable of diagnosing or correcting many engine 
system anomalies and failures that affect a wide range of engine system parameters which may not necessarily 
exceed any of the existing single-parameter redline thresholds. Introduction of the AHMS Phase 2 Health 
Management Computer (HMC) is intended to complement the SSMEC by providing a more “intelligent’ ’ system to 
diagnose and correct, or at the least, mitigate the effects of various SSME system anomalies and failures in order to 
minimize the detrimental impact to the mission and the Shuttle Orbiter itself. The AHMS addresses the Shuttle 
program’s number one goal of flying safely by providing the capability to turn catastrophic (Critical 1) failures into 
aborts and aborts into more preferred aborts (Abort to Orbit (ATO) from Return to Launch Site (RTLS)). 

The Phase 2 AHMS will be an on-board vehicle system that consists of both hardware and software. Three 
HMCs along with the necessary software, interconnecting cabling, cockpit switches, and modifications to the 
SSMEC software will comprise the Phase 2 portion of the AHMS. The purpose of the AHMS is twofold; one is to 
increase the probability of successfully placing the Orbiter into the intended orbit, and the other is to increase the 
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probability of being able to safely execute an abort of a Space Transportation System launch 3 . Both objectives are 
achieved by increasing the useful work envelope of a SSME after it has developed anomalous performance during 
the launch and the ascent phase of the mission. This increase in work envelope will be the result of new anomaly 
mitigation options, in addition to engine shutdown, that were previously unavailable. The added anomaly mitigation 
options include engine throttle-down and performance correction (adjustment of oxidizer to fuel ratio), in addition to 
enhanced sensor disqualification capability. The HMC is intended to provide the computing power necessary to 
diagnose selected anomalous engine behaviors and for making recommendations to the engine controller for 
anomaly mitigation. Included in this system will be the capability to inhibit mitigation recommendations in both 
the HMC and the SSMEC should the need arise. This is consistent with the current flight approach where redlines 
may be inhibited when one or more engines have been shutdown and the remaining engine(s) are needed to provide 
thrust to avoid loss of crew or vehicle. 

Phase 2 of die AHMS program will incorporate one HMC per engine, i.e. three HMCs per Orbiter. The baseline 
plan is to locate the HMCs in the aft compartment of the orbiter a short distance from the engines. This location 
was chosen because the present envelope of the SSME doesn’t allow space for this new equipment. 

The technical approach to the HMC is to utilize commercially-derived hardware and software to the maximum 
possible extent, to utilize high reliability radiation hardened or tolerant hardware components to the maximum 
possible extent and to augment these components with system-level fault tolerance techniques to maximize system 
reliability and availability. The technical approach involves two independent processing channels with cross- 
channel exchange and comparison of results to minimize the possibility of the HMC issuing an erroneous engine 
mitigation recommendation. The HMC Engine Health Assessment Function, which performs the cross-channel 
comparison, provides the fault/error containment boundary for the HMC that prohibits erroneous corrective engine 
action recommendations from being issued. 

Each HMC obtains 28 Vdc power from the Orbiter power bus. Signals from the main propulsion system, e.g., 
engine temperatures and pressures, and signals from various turbine, engine, gimbal, and OPB (Oxidizer Prebumer) 
accelerometers are fed to the HMC for conversion and processing. Several RS485A-based interfaces are provided to 
allow the exchange of digital signals between the SSMEC and the other two HMCs in the AHMS. Spare RS485A- 
based interfaces are provided to support future expansion and growth. The HMC is divided into two independent 
processing channels, designated Channel A and Channel B. The design consists of an open system backplane, one 
power supply module to convert the 28 Vdc Orbiter power bus to the 5, 3.3, 2.5, and +12 Vdc required by the HMC 
electronic components, two general purpose SBC (Single Board Computer) modules (one per channel), one Non- 
Volatile memory module (common to both channels), two Analog I/O modules, and two Digital I/O modules. The 
HMC chassis accommodates up to fourteen (14) modules, also referred to as Circuit Card Assemblies (CCAs). 
Thirteen (13) of the available module slots are split between two independent cPCI backplanes. The power supply 
module slips into the remaining chassis slots. The secondary voltages and voltage sense signals from the power 
supply module are provided through the cPCI backplanes. The spare card slots can be used for additional SBC 
modules, additional Mission Data Non-Volatile Memory (MDNVM) modules, and additional I/O capability for 
increased performance, flexibility, and expansion. The SBC modules contain interfaces for lab and depot testing. 
Pre-launch testing and check-out is accomplished through the GSE connection. 

The MDNVM module is a commercial-based 1 GByte flash memory module developed for space applications. 
The baseline design only contains one non-volatile memory module. This is because, although there are two 
(redundant) digital processing channels, there is only one set of raw sensor data to be stored, the data and processed 
recommendations stored in the non-volatile memory are for post-flight analysis. The MDNVM module has internal 
fault tolerance including EDAC to handle soft errors. 

There are two (2) Analog I/O modules in the baseline HMC system. In total, there are fifteen (15) engine 
accelerometer and shaft-speed indicator analog signals to be sampled. These include: the five (5) turbine end 
accelerometer signals, the six (6) pump end accelerometer signals, the one (1) gimbal accelerometer, the one (1) 
oxygen pre-burner accelerometer, and the two (2) shaft-speed indicators. The two shaft-speed and the six pump- 
end accelerometer signals are preconditioned in the SSMEC while the turbine-end, OPB, and Gimbal accelerometers 
are routed directly to the HMC for processing. The Analog I/O cards also processes Main Propulsion System 
(MPS) engine inlet conditions such as engine inlet pressures and temperatures for both oxidizer and fuel that are 
required for proper algorithm operation. 
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The Digital I/O modules provide the High Speed Serial (HSSI), HMC Inter-System Monitor (HISM), and 
Ground Support Equipment (GSE) interfaces for the HMC. There are two Digital I/O modules per HMC. The 
interfaces are split into Channel A and Channel B and each channel contains one HSSI and one HISM. The Channel 
A Digital I/O CCA handles the GSE interfaces. The Channel B Digital I/O CCA supports two spare interfaces. The 
GSE interfaces employ software-implemented CRC coding to validate correct transmission of data and commands. 
All of the external serial synchronous interfaces are RS485A-based and implement HDLC protocol. These RS485A- 
based interfaces have lightning protection circuitry in accordance with NSTS 07636 Rev. G. 



Figure 2: Health Management Computer Mockup 

Expansion capability, through excess processing capability and memory and an expansion port, will be provided for 
incorporation of additional health management features in the future. 



Figure 3: Interface of HMC into Shuttle System 
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In order to provide detection and mitigation capabilities for the SSME, algorithms that could perform the 
required analysis were developed, based on long-standing practices used by engineers to perform post-test analysis 
of hot-fire test data. These algorithms are the Advanced Real-Time Vibration Monitoring System (ARTVMS), 
developed by NASA-MSFC, and the Linear Engine Model (LEM), developed by BCP. Integrating the results of 
these two diagnostic algorithms will be the responsibility of the Engine Health Assessment Function (EHAF). This 
algorithm will integrate the outputs of the individual systems, attempt to determine root cause, and provide any risk 
mitigation action recommendations to the SSMEC. The data analysis techniques and processes utilized by these 
algorithms have been in practice at NASA-MSFC and BCP for many years for conducting post-hot-fire data 
analysis. As part of the AHMS project, these techniques have been translated into reliable processes that can be 
run in real-time. The diagnostic algorithms that have been developed are intended to provide an early insight into 
engine anomalies by looking for precursors of anomalous engine operation. Therefore, the diagnostic algorithms 
are intended to provide an earlier indication of anomalous operation, rather than a fast response once an anomaly has 
propogated to the point where a catastrophic condition is imminent. 

The ARTVMS, an extension of the synchronous vibration redline incorporated into AHMS Phase 1. ARTVMS 
will analyze a wider spectrum of frequency than Phase 1(10 KHz versus 5 KHz for Phase 1) and builds upon Phase 
1 by examining the response of harmonics of synchronous (2N, 3N, 4N, etc) and by adding turbine-end 
accelerometers to provide increased sensitivity to turbine-side anomalies. Furthermore, ARTVMS will employ 
phase analysis algorithms to detect the presence of detrimental sub-harmonic phenomena such as sub-harmonic 
resonance or sub-synchronous whirl which are indicators of rotor instability or fluid instability, respectively. These 
phase correlation algorithms will allow increased sensitivity to conditions that are not immediately manifested 
through the synchronous frequencies and allow for more accurate and timely diagnosis of anomalous 
turbomachinery behavior. Although not planned for implementation into the initial version, the capability exists to 
monitor bearing-related frequencies (cage, ball spin, inner race and outer race passing) for indications of bearing 
health and to monitor for cavitation induced vibration responses 

The LEM, a system diagnostic algorithm that utilizes a wide range of engine system performance parameter 
sensors across the engine system (pressures, temperatures, speeds, and valve positions) and engine-to-Orbiter 
interface conditions to detect and diagnose a set of predefined engine anomalies. LEM is based upon the SSME 
Power Balance Model (PBM), a non-linear, thermodynamic mass and energy balance model that simulates 
mainstage operation of the SSME, using techniques that have been used for post-test analysis since Atlas engine 
testing of the 1950s. LEM has been utilized for post-test and post-flight analysis for more than 20 years and a 
version has been developed that performs real-time analysis of hot- fire data that has been used at BCP since 1999. 
Furthermore, a ground-based version of LEM was delivered to the JSC Mission Operations Directorate (MOD) 
group in May 2002 for use as a booster console analysis tool during Shuttle ascent. 

The LEM seeks to detect anomalous engine conditions by explaining the differences between a predetermined 
baseline slice of data and slices of data taken at various times throughout a flight or test. This baseline could be 
either a preflight prediction or a slice of data taken from within the flight. The LEM initially utilizes a pretest 
prediction and test-to-test data variation statistics. In order to utilize more sensitive slice-to-slice statistics that are a 
measure of data variation within a test (as opposed to between tests), the baseline is changed early in the ascent after 
checks are performed to confirm that no engine anomalies are present. The differences between observed and 
baseline data are adjusted for differences in engine inlet and other known conditions so that the remaining 
differences are attributed to a predetermined set of anomalies. The algorithm is flexible enough to add or remove 
anomalies through data input. The LEM determines the magnitude and direction of each anomaly that would 
explain the differences observed in the data and then ranks each based on the confidence associated with each 
anomaly. If the magnitude and direction are sufficient to pass the appropriate threshold criteria, then the result will 
be passed along to the EHAF. 

The EHAF is an overarching algorithm that combines the results from the other diagnostic systems and 
determines the correction mitigation recommendation based on predetermined criteria. The EHAF receives results 
from the individual algorithms and determines the proper mitigation recommendation, if any, that should be sent to 
the SSMEC for implementation. The EHAF contains a prioritized set of rules that determines what 
recommendation is appropriate for a given engine anomaly and operating condition. The available set of 
recommendation options include engine shutdown, engine throttledown, mixture ratio correction, and redline or 
control sensor disqualification. 
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In the event that a rapidly progressing failure or anomaly occurs that limits the time that is available for the 
diagnostic algorithms to detect and recommend a mitigation action, the AHMS system incorporates a “quick” 
throttledown system to throttle an engine down to a lower power setting (either 67% or 85% of rated thrust, 
depending on the altitude of the Orbiter at the time of the throttle mitigation recommendation). This lowers the 
probability of a catastrophic engine failure by reducing the severity of the engine operating environment. At 67%, 
for instance, the pressures and temperatures associated with key engine operating parameters are much less than at 
the 104.5% nominal operating condition, as illustrated in Table 1. The quick throttledown system is similar to the 
present redline system that is meant to shut an engine down when all qualified measurements of a particular engine 
performance parameter (for instance, HPOTP turbine discharge temperature has four redundant measurements) 
exceed predetermined limits. The throttle system monitors various engine system operating parameters, some of 
which are currently redline parameters, as well as several parameters that are not currently redline parameters, to 
allow a throttle at limits that are lower than the redline limits, thereby allowing the engine to continue to provide 
thrust to the vehicle and allow the time for additional mitigation recommendations, if required. 

The Shuttle Orbiter derives benefit from this upgrade in a number of ways. The ability to throttle down the 
engine not only decreases the probability of a catastrophic engine event, but also enables the Shuttle to potentially 
make a mission that previously would have resulted in an abort. Figure 4 illustrates the abort regions for the shuttle 
over the course of a typical mission (in this case, STS-98). Without the benefit of throttling an anomalous engine, 
the Shuttle is first subject to the Retum-to-Launch-Site (RTLS) abort mode, then the Transatlantic Abort Landing 
(TAL), and then an Abort to Orbit (ATO) prior to reaching Press to Main Engine Cutoff (MECO). If a throttle 
action is allowed, even as early as right off the launch pad, the Shuttle has enough thrust to bypass the RTLS and 
TAL abort scenarios and execute an ATO. If the throttle action occurs after 217 seconds following launch, analysis 
indicates that the Orbiter will successfully complete the ascent to orbit. This analysis is significant since a Dynamic 
Ascent Risk Evaluation (DARE) study has shown that the risk of catastrophic failure of the Orbiter is roughly 1 out 
of 40 for an RTLS. A TAL is predicted to be an order of magnitude lower than RTLS, with an ATO estimated to be 
approximately 50 times less risky than an RTLS. Therefore, the further along into the mission, the less risky the 
abort is predicted to be. 


Block II SSME Throttle Down Comparison 

BIOCK II 
•/•Difference 
Between 
67% 
and 

Parameter Units 104.5% 

Vacuum Thrust 

Ibf 

-36% 

Vacuum Specific Impulse 

Seconds 

-0.2% 

Engine Total Flow 

Ibm/sec 

-36% 

HPFT Discharge Temp 

deg R 

-10% 

HPOT Discharge Temp 

deg R 

-19% 

HPFTP Pump Discharge Press 

psia 

-36% 

HPOTP Pump Discharge Press 

psia 

-42% 

HPFTP Speed 

rpm 

-20% 

HPOTP Speed 

rpm 

-27% 

FPB Chamber Press 

psia 

-42% 

OPB Chamber Press 

psia 

-42% 

LPFTP Speed 

rpm 

-11% 

LPOTP Speed 

rpm 

-26% 

HPFTP Turbine Power 

HP 

-57% 

HPOTP Turbine Power 

HP 

-63% 

HPFTP Turbine Pressure Drop 

psi 

-51% 

HPOTP Turbine Press Drop 

psi 

-52% 


Table 1 - Difference between Block II engine operation at 67% and 104.5% power levels 
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Single SSME Out 
Intact Abort 
, (104. 5 VI 04.5 VD%) 
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ENGINE 

CUTOFF 

520 sec 


375 sec 
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275 sec 

(sec) 

149 sec 


520 sec 


Two Engine Press to 
Main Engine Cutoff (MECO) Abort 

y. Two Engine Press to 

Abort to Orbit (ATO) Abort 



Two Engine Transoceanic 
Abort Landing (TAL) Abort 


y Two Engine Return to 
Launch Site (RTLS) Abort 


217 sec 


Single SSME Throttled and 
Continues to Run 
(104.5%/104.5W67%) 


v 2 Nominal, 1 Throttled 
' Engine Press to MECO Abort 


y. 2 Nominal, 1 Throttled 
Engine Press to ATO Abort 


Abort Boundaries 
without Phase 2B 


Abort Boundaries 
with Phase 2B 


Note Based on STS-98 trajectory 
Results sensitive to mission 
specific requirements 


Figure 4: Benefits of Throttledown to Abort Boundaries 


Since the focus of future Shuttle missions will be on completing the construction of the International Space 
Station (ISS), this analysis was also conducted to determine the impact of AHMS on achievement of ISS rendezvous 
missions. Figure 5 illustrates the use of AHMS throttledown. Note that a throttle option provides an additional 107 
seconds of protection (based on STS-1 14 mission analysis) in terms of being able to rendezvous with the ISS. 


MAIN 

ENGINE 

CUTOFF 


MET 

(sec) 


LIFTOFF 


520 sec | 


438 seel 


Single SSME Out 
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Rendezvous with ISS 
Possible 


V Can’t Rendezvous with ISS 


520 sec ■ 


331 sec 


Single SSME Throttled and 
Continues to Run 
(104.5VI04.5V67%) 


iRendezvous with ISS 
Possible 


> Can’t Rendezvous with ISS 


Rendezvous Success 
without Phase 2B 


Rendezvous Success 
with Phase 2B 


Note: Based on STS-1 14 performance 
and no joint underspeed recovery. 
Results sensitive to mission specific 
requirements 


Figure 5: Benefits of Throttledown to Achievement of ISS Rendezvous 

An additional benefit derived from AHMS is the ability to change the engine mixture ratio in response to an 
engine anomaly. As illustrated in Figure 6, a mixture ratio correction option allows an ISS rendevous to be 
achieved for a nozzle leak that occurs at liftoff and is corrected within 150 seconds of launch. 
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LZ 
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Rendezvous Success 
without Phase 2B 


Rendezvous Success 
with Phase 2B 


Figure 6: Benefits of MR Correction to Achievement of ISS Rendezvous 

Another advantage of the AHMS is the flexibility and expandability of the system and its applicability to any 
other rocket engine system that exists now or that is developed in the future. The present algorithms were 
developed with the characteristics of the SSME in mind but the basic functionality is not limited to a staged 
combustion engine cycle in general or the SSME in particular. The basic functionality of the ARTVMS lies in its 
ability to detect and examine synchronous frequency of rotating machinery so any rocket engine that utilizes rotating 
machinery is a viable candidate for analysis using ARTVMS. As long as the frequency characteristics of 
synchronous and other anomalous conditions are understood, the proper criteria can be easily programmed into the 
algorithm. This is equally true for the LEM. The basic algorithm would be the same for any engine configuration, 
with the only changes needed being input data and other engine characteristic data such as engine variation 
information and a list of covered anomalies. 

Implementation of AHMS Phase 2B is calculated to result in a 21% reduction in SSME ascent risk (three engine 
cluster) as compared to SSME ascent risk with AHMS Phase 1 implementation alone. Note that this risk reduction 
value was derived from October 1998 QRAS data. 


IV. Conclusion 

The AHMS system is a two-phased, expandable, and flexible upgrade to the SSME system that will improve the 
ascent reliability and safety of the Shuttle Orbiter during the launch and ascent phases of a Shuttle mission by 
providing the capability to complete missions that would not have been completed previously and to turn 
catastrophic failures into aborts and aborts into more preferred aborts. The introduction of the synchronous 
vibration redline will enhance engine and Orbiter safety by providing the capability to monitor vibration-related 
turbomachinery anomalies. Implementation of the Phase 2 system through the introduction of an open architecture 
HMC will provide the capability to run algorithms that build upon the vibration redline from Phase 1 and add engine 
performance management through the introduction of additional mitigation actions, specifically engine throttledown, 
mixture ratio correction, and control and redline sensor disqualification. The algorithms are flexible and 
expandable and could be easily adapted for other engine configurations by changing input data. These AHMS 
capabilities will enhance not only the safety of the engine and Orbiter but also the probability of mission success by 
expanding the useful work envelope of the SSME. Independent auditors have assessed the reduction in Shuttle 
ascent risk to be on the order of 40% with the combined system and a three times improvement in mission success. 
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